Spring Boot 2.7.5移除WebSecurityConfigurerAdapter后认证配置异常求助

核心问题 #

1. SecurityFilterChain未注册为Bean：重构后的configure(HttpSecurity http)方法没加@Bean注解，Spring识别不到自定义安全过滤器链，启用了默认配置，和自定义AuthenticationManager产生冲突。
2. AuthenticationManager构建方式错误：直接用AuthenticationManagerBuilder.build()创建对象，绕过Spring Security的AuthenticationConfiguration自动配置流程，导致后续配置无法应用到已构建的对象上，触发Cannot apply ... to already built object异常。

修复后的SecurityConfig代码 #

@EnableWebSecurity
public class SecurityConfig {

    private final UserDetailsService userDetailsService;
    private final CustomPasswordEncoder customPasswordEncoder;
    private final JwtFilter jwtFilter;

    // 用构造注入替代@Autowired（Spring官方推荐）
    public SecurityConfig(UserDetailsService userDetailsService,
                          CustomPasswordEncoder customPasswordEncoder,
                          JwtFilter jwtFilter) {
        this.userDetailsService = userDetailsService;
        this.customPasswordEncoder = customPasswordEncoder;
        this.jwtFilter = jwtFilter;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        // 通过AuthenticationConfiguration获取Spring管理的AuthenticationManager，而非自行构建
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        // 暴露PasswordEncoder为Bean，让AuthenticationConfiguration自动识别
        return customPasswordEncoder.getPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable()
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .exceptionHandling(exceptions -> exceptions
                .authenticationEntryPoint((request, response, ex) -> {
                    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, ex.getMessage());
                }))
            .authorizeRequests(auth -> auth
                .antMatchers("/api/auth/**", "/swagger-ui/**", "/v3/api-docs/**", "/error**").permitAll()
                .anyRequest().authenticated())
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

关键修复点说明 #

• 给securityFilterChain方法加@Bean：让Spring使用自定义安全过滤器链，避免默认配置干扰。
• 通过AuthenticationConfiguration获取AuthenticationManager：遵循Spring Security自动配置流程，确保所有认证配置正确生效。
• 暴露PasswordEncoder为Bean：Spring Security的AuthenticationConfiguration会自动发现并使用该Bean，替代原手动在AuthenticationManagerBuilder中的配置。
• 构造注入替代@Autowired：符合Spring官方推荐的依赖注入方式，提升代码可测试性和可靠性。

验证 #

修复后重启应用，Bean创建异常会被解决，AuthController中的AuthenticationManager能正确注入，登录接口可正常使用。

内容的提问来源于stack exchange，提问作者Georgios Kompos